Crypto hacks stole $1.18 billion in Q3, the worst quarter since Bybit, and 77% of it came from outside smart contracts

Hackers stole about $1.18 billion from crypto platforms in the third quarter of 2026, the worst quarter since Bybit’s $1.4 billion breach in early 2025, according to security firm Hacken. Most of the damage did not come from smart contract bugs. Compromised suppliers, developer tools and unpatched known flaws accounted for $906 million, or 77% of losses.

Q3 crypto hacks expose weaknesses in crypto infrastructure

The $1.18 billion in quarterly losses represented a sharp reminder that cybersecurity risks remain a significant concern for digital-asset businesses. The last quarter with greater losses was Q1 2025, when the $1.4 billion Bybit hack, attributed to North Korea, contributed to total cryptocurrency losses of approximately $1.6 billion.

The distribution of incidents in the latest quarter shows how a relatively small number of attacks can account for a disproportionate share of the damage. Although four major incidents generated most of the reported losses, 98 of the 107 recorded incidents resulted in losses below $10 million.

The median loss was $670,000, illustrating that substantial financial damage was not limited to the largest exchanges or protocols.

Supplier compromises and infrastructure failures were particularly significant. Attackers can exploit weaknesses in external services, software dependencies and development tools to bypass protections that might otherwise secure a blockchain application.

Hacken’s findings also pointed to publicly disclosed fixes that had not been deployed. Delays in implementing security updates can leave systems exposed even after a vulnerability has been identified.

Smart contracts nevertheless remained the most frequently exploited attack vector. The report recorded 71 smart contract incidents, resulting in approximately $228 million in losses.

The figures suggest that cryptocurrency security requires a broader approach than auditing smart contracts alone. A protocol can review its own code and still face risks from the external services, signing systems and infrastructure on which it depends.

Recovery after Q3 crypto hacks returned millions to users

Despite the scale of the incidents, approximately $387 million of the $1.18 billion in gross losses was returned or reversed, representing around 33% of the total.

The Liquid Network incident accounted for the largest recovery described in the report. Following the exploit, individuals identifying themselves as “white hats” returned approximately $272 million, equivalent to about 85% of the stolen value.

The recovery significantly reduced the incident’s lasting financial impact, although the return of funds does not eliminate the security weaknesses that allowed the exploit to occur.

Tectonic followed a different route to reverse much of its reported damage. Cronos validators rolled back 114 minutes of settled blockchain history, reversing approximately $111.2 million of the $120.4 million in affected borrowing.

The intervention illustrates one of the difficult questions facing blockchain networks after an exploit: whether reversing transactions can protect users or whether doing so creates concerns about transaction finality and the network’s governance.

Stablecoin issuers Circle and Tether also froze approximately $340,000 linked to the Bitget theft, according to the supplied report. Such interventions can help restrict the movement of identifiable assets, although the amount frozen was small compared with the overall losses associated with the incident.

The Q3 crypto hacks therefore produced different recovery outcomes depending on the incident, the assets involved and the measures available to affected organizations.

Crypto platforms covered additional losses from their own funds

Returning stolen assets was only one part of the industry’s response. Operators also covered approximately $410 million in user losses using their own funds, according to Hacken’s report.

Bitget’s user protection fund covered $387 million. Triple-A, Coinsbuy and TAC repaid approximately $22 million combined, helping make affected users whole even though the stolen assets remained with the attackers.

This distinction is important when assessing the financial consequences of cryptocurrency exploits. A user may receive compensation from an exchange or service provider without the underlying stolen funds being recovered. In such cases, the operator absorbs the financial burden rather than eliminating the attacker’s gains.

The report estimated that approximately $384 million, or 32% of gross losses, was neither returned nor covered.

Taken together, the reported recoveries, reversals and operator-funded payments demonstrate that post-incident responses can substantially reduce the losses ultimately borne by users. However, the remaining uncovered amount shows that compensation mechanisms cannot guarantee a complete recovery after every exploit.

Protection funds can help maintain customer confidence, but their effectiveness depends on their size, the operator’s financial resources and the circumstances of an incident. Not every cryptocurrency business has the capacity to reimburse customers on the scale reported by Bitget.

Hacken urges broader security audits after Q3 crypto hacks

Hacken urged cryptocurrency projects to strengthen the cybersecurity of third-party suppliers, developer tools and other external infrastructure that may not be included in conventional security audits.

The company also recommended expanding protocol reviews to cover oracles, bridges, custody systems, signing authorities and other privileged components.

These recommendations address the wider attack surface highlighted by the quarter’s losses. Oracles provide external data to blockchain applications, while bridges facilitate transfers between networks. Custody systems and signing authorities can control access to digital assets or authorize transactions, making weaknesses in those components particularly consequential.

A comprehensive security programme must therefore consider how different parts of a system interact, rather than treating each smart contract as an isolated component.

The findings also underscore the importance of applying security patches promptly, assessing external software dependencies and regularly reviewing access permissions. Where third-party infrastructure is involved, protocols need clear procedures for monitoring suppliers and responding when vulnerabilities are disclosed.